Regulations › Rest of world › Uruguay
LPDP
Law 18,331 on Personal Data Protection and Habeas Data Action
WhenIn effect since 18 August 2008
Who enforces itUnidad Reguladora y de Control de Datos Personales (URCDP)
Who it applies toPublic and private processing of personal data in Uruguay, and foreign controllers targeting or monitoring people there.
Tell the regulatorNotify the URCDP within 72 hours of becoming aware of a breach, then file a detailed report on…
DPO requiredDPO required for public bodies, majority state-owned entities, private entities whose core bus…
RegistrationAll public and private databases, other than purely personal ones, must be registered with the…
Transfers abroadTransfers prohibited to countries without adequate protection, except listed cases (explicit c…
Request deadlineAccess and rectification or suppression requests within 5 business days
Maximum fineUp to 500,000 indexed units (UI) (roughly USD 80,000), plus warning or suspension of the datab…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to non-established controllers offering goods or services to, or analyzing behavior of, people in Uruguay, or using means located there.Decree 64/020 art. 1 (Law 19,670 art. 37) · source ↗
Lawful basis
3
Consent is the default basis, with exceptions for public sources, state functions, limited listings, contracts and domestic use. No legitimate interests.Art. 9 · secondary source · source ↗
Law text read from a utility-hosted copy of the official law.
Consent
3
Consent must be free, prior, express and informed, and must be documented.Arts. 4(C), 9 · secondary source · source ↗
Sensitive data
2
No one may be compelled to provide sensitive data; processing needs express written consent or legal authorization for general interest.Art. 18 · secondary source · source ↗
Children
0
No child-specific rule or age threshold in the Law; minors' data listed among vulnerable groups triggering a DPIA.Not addressed; Decree 64/020 art. 6 · source ↗
People's rights
Rights
2
Access, rectification, updating, inclusion, suppression; challenge automated decisions; removal or blocking of marketing data.Arts. 14-16, 21 · secondary source · source ↗
Request deadline
3
Access and rectification or suppression requests within 5 business days.Arts. 14, 15 · secondary source · source ↗
Marketing
1
Marketing profiles only from public sources, data provided by the holder or with consent; holder may request removal or blocking at any time.Art. 21 · secondary source · source ↗
Governance
DPO required
1
DPO required for public bodies, majority state-owned entities, private entities whose core business is sensitive data, and those processing data of over 35,000 people.Decree 64/020 art. 10 (Law 19,670 art. 40) · source ↗
DPO qualifications
2
DPO must prove specialized legal knowledge in data protection; designation must be communicated to the URCDP within 90 days.Decree 64/020 arts. 12, 14 · source ↗
Registration
2
All public and private databases, other than purely personal ones, must be registered with the URCDP, including foreign controllers in scope.Arts. 28-29; Decree 64/020 art. 2 · secondary source · source ↗
DPIA
2
DPIA required before processing core sensitive data, profiling, vulnerable groups, large volumes, or transfers to non-adequate countries.Decree 64/020 arts. 6-7 · source ↗
Records
1
Accountability measures must be documented and available to the URCDP; database registration describes processing.Decree 64/020 art. 5 · source ↗
Retention
2
Delete data once no longer necessary; negative credit records limited to 5 years, renewable once.Arts. 8, 22 · secondary source · source ↗
Breaches
Tell the regulator
2
Notify the URCDP within 72 hours of becoming aware of a breach, then file a detailed report once resolved.Decree 64/020 art. 4 · source ↗
Tell people
2
Notify affected individuals of significant breaches in clear, simple language.Decree 64/020 art. 4 · source ↗
Transfers
Transfers abroad
2
Transfers prohibited to countries without adequate protection, except listed cases (explicit consent, contract, vital interest); URCDP may authorize transfers with safeguards.Art. 23 · secondary source · source ↗
Enforcement
Maximum fine
1
Up to 500,000 indexed units (UI) (roughly USD 80,000), plus warning or suspension of the database.Art. 35 · secondary source · source ↗
Criminal liability
0
No criminal offenses in the data protection law.Not addressed · secondary source · source ↗
Private action
2
Habeas data court action with summary procedure to access, rectify, include or delete data.Arts. 37-45 · secondary source · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws